5G Dual-Domain Private Network Access with Decoupled Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing 5G dual-domain private networks constrain campus UE access to the public network by requiring concurrent secondary authentication with PDU session establishment, leading to potential access failures and IP address conflicts.
Innovation Solution
The system allows campus UEs to access the public network without secondary authentication by subscribing to secondary authentication parameters in the PCF with DNAI granularity, enabling the SMF to establish a PDU session with the public network UPF based on a general DNN, and using ULCL UPF to divert data packets to both intranet and public networks, with IP address replacement to resolve conflicts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If secondary authentication is contracted at the granularity of DNN in UDM, then campus UE can be authenticated for intranet access, but the establishment of PDU session between campus UE and public network is constrained by secondary authentication
Solution Approach 1:
The patent segments the authentication process into two independent parts: primary authentication (handled by AMF for general network access) and secondary authentication (handled by DN-AAA for intranet access). By separating these functions and moving secondary authentication contract from UDM to PCF at DNAI granularity, the PDU session establishment is no longer blocked by intranet authentication requirements, allowing campus UEs to access public network freely while still enabling intranet access when needed.
Solution Approach 2:
The patent introduces PCF as an intermediary component that mediates between UDM and AMF. PCF receives the secondary authentication contract from UDM and forwards it to AMF with appropriate context information. This intermediary mechanism allows the authentication information to be transmitted and processed without directly blocking the PDU session establishment flow, thus resolving the contradiction between authentication reliability and ease of operation.
2Reliability
If secondary authentication must be carried out concurrently with PDU session establishment, then trusted access to intranet is ensured, but access to public network fails when secondary authentication fails
Solution Approach 1:
The patent segments the access paths: public network access goes through AMF and UPF without requiring secondary authentication, while intranet access requires secondary authentication via DN-AAA. This segmentation allows campus UEs to maintain high productivity for public network access while still ensuring trusted access to intranet when needed, eliminating the blocking effect of authentication failures on public network connectivity.
Solution Approach 2:
The patent makes the authentication requirement dynamic rather than static. Instead of requiring secondary authentication for all accesses, the system dynamically determines whether secondary authentication is needed based on the destination network. The AMF and ULCL UPF dynamically route traffic to public network or intranet based on real-time conditions, allowing access availability to adapt to authentication status without compromising trusted access when required.
3Adaptability or versatility
If general DNN is used for PDU session establishment, then public network access is enabled, but IP address conflict occurs when campus UE accesses intranet
Solution Approach 1:
The patent introduces ULCL UPF as an intermediary component between the public network UPF and the intranet. ULCL UPF receives packets from the public network, inspects destination addresses, and selectively forwards them to the intranet through intranet UPF. This intermediary mechanism allows general DNN to be used for PDU session establishment while preventing IP address conflicts by controlling which packets enter the intranet domain, thus maintaining both access flexibility and IP uniqueness.
Solution Approach 2:
The patent applies local quality control at the ULCL UPF level, where packet inspection and forwarding decisions are made based on local network conditions and destination addresses. Instead of applying uniform IP allocation throughout the entire network, the system applies differentiated quality control: public network packets use public IP addresses, while intranet packets are selectively routed and have their IP addresses managed locally, preventing conflicts while maintaining versatility.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are an access method, a system and an apparatus, and an electronic device for a 5G dual-domain private network. In the method, the campus UE subscribes to the secondary authentication function with the DNAI as the granularity in the Policy Control Function (PCF) (note: in the PCF, there are secondary authentication parameters bound to the DNAI subscribed by the campus UE). This not only achieves the secondary authentication is performed on the campus UE when it is determined that the campus UE has a need to access the campus intranet, ensuring credible access for the campus UE, but also realizes the use of a Data Network Name (DNN) to access the campus intranet under the constraint of secondary authentication, while using the DNN to access the public network can be free from the constraint of secondary authentication, that is, access to the public network is decoupled from the secondary authentication. Additionally, through IP address replacement, potential IP conflicts are avoided.